Methods and systems for IP-based network intrusion detection and prevention

Abstract

An authentication system includes an authentication module maintaining a store of credentials for a set of users. In response to an identity specified by credentials provided from a requestor address not being found in the store of credentials, the authentication module transmits an authentication failure response. In response to the provided credentials matching selected credentials, the authentication module transmits an authentication success response. The authentication system includes an analyzer module configured to determine a number of identity-not-found failures corresponding to a first address, identify a triggering event in response to the number exceeding a predetermined threshold, and, in response to the triggering event, add the first address to a block list. The authentication system includes a query module configured to, in response to a query for a specified address, determine whether the specified address is present in the block list and, if so, instruct transmission of the authentication failure response.

What is claimed is: 
     
       1. An authentication system comprising:
 an authentication module configured to,
 maintain a store of credentials for a set of users; 
 receive an authentication request from a requestor address; 
 in response to an identity specified by credentials provided from the requestor address not being found in the store of credentials, transmit an authentication failure response to the requestor address and record a failure event in an event cache, wherein the failure event indicates the requestor address and indicates an identity-not-found failure mode; and 
 in response to the provided credentials matching selected credentials in the store of credentials, selectively transmit an authentication success response to the requestor address; 
 
 an analyzer module configured to,
 analyze events in the event cache to determine a number of identity-not-found failures corresponding to a first address; 
 identify a triggering event in response to the number of identity-not-found failures exceeding a threshold; and 
 in response to the triggering event, add the first address to a block list; and 
 
 a query module configured to, in response to a query from the authentication module for a specified address,
 determine whether the specified address is present in the block list; and 
 in response to the specified address being present in the block list,
 if the credentials provided from the requestor address are not found in the store of credentials, instruct the authentication system to transmit the authentication failure response to the requestor address, and 
 if the credentials provided from the requestor address are found in the store of credentials, instruct the authentication system to selectively transmit the authentication success response to the requestor address. 
 
 
 
     
     
       2. The authentication system of  claim 1  wherein:
 the provided credentials include a username and a hash of a password; and 
 the username specifies the identity for the provided credentials. 
 
     
     
       3. The authentication system of  claim 1  wherein the number of identity-not-found failures related to the first address is restricted to those occurring in a period of time prior to the analysis. 
     
     
       4. The authentication system of  claim 3  wherein the threshold and the period of time are configurable by an administrator. 
     
     
       5. The authentication system of  claim 1  wherein the analyzer module is configured to:
 specify an expiration time when adding the first address to the block list; and 
 in response to the expiration time being reached, remove the first address from the block list. 
 
     
     
       6. The authentication system of  claim 5  wherein the expiration time is based on a sum of a time of the triggering event and a configurable block length. 
     
     
       7. The authentication system of  claim 1  wherein the authentication module is configured to, in response to the provided credentials matching the selected credentials, record a success event in the event cache, wherein the success event includes the identity. 
     
     
       8. The authentication system of  claim 7  wherein:
 the failure event indicates the identity; and 
 the analyzer module is configured to,
 analyze events in the event cache to determine a number of unique identities presented by the first address; and 
 selectively identify the triggering event in response to the number of unique identities exceeding a second threshold. 
 
 
     
     
       9. The authentication system of  claim 8  wherein the analyzer module is configured to:
 analyze events in the event cache to determine a number of unique identities presented by the first address within a time period; and 
 identify the triggering event in response to the number of unique identities within the time period exceeding the second threshold. 
 
     
     
       10. The authentication system of  claim 1  wherein:
 the authentication module is configured to, in response to the identity specified by the provided credentials being found in the store of credentials but the provided credentials failing to match any of the store of credentials, transmit the authentication failure response to the requestor address and record the failure event in the event cache, wherein the failure event indicates the requestor address and indicates a credential failure mode; and 
 the analyzer module is configured to,
 analyze events in the event cache to determine a number of total failures corresponding to the first address; and 
 identify the triggering event in response to the number of total failures exceeding a second threshold. 
 
 
     
     
       11. The authentication system of  claim 1  wherein the analyzer module is configured to reduce the threshold for the first address in response to the first address having been previously blocked. 
     
     
       12. An authentication method comprising:
 Maintaining, at a memory hardware, a store of credentials for a set of users; 
 receiving, with a processor hardware, an authentication request from a requestor address; 
 in response to an identity specified by credentials provided from the requestor address not being found in the store of credentials, transmitting, with the processor hardware, an authentication failure response to the requestor address and recording a failure event in an event cache, wherein the failure event indicates the requestor address and indicates an identity-not-found failure mode; 
 in response to the provided credentials matching selected credentials in the store of credentials, selectively transmitting, with the processor hardware, an authentication success response to the requestor address; 
 analyzing events, with the processor hardware, in the event cache to determine a number of identity-not-found failures corresponding to a first address; 
 identifying, with the processor hardware, a triggering event in response to the number of identity-not-found failures exceeding a threshold; 
 in response to the triggering event, adding, with the processor hardware, the first address to a block list; 
 in response to a query for a specified address:
 determining, with the processor hardware, whether the specified address is present in the block list; and 
 in response to the specified address being present in the block list,
 if the credentials provided from the requestor address are not found in the store of credentials, instructing, with the processor hardware, the authentication method to transmit the authentication failure response to the requestor address, and 
 if the credentials provided from the requestor address are found in the store of credentials, instructing, with the processor hardware, the authentication method to selectively transmit the authentication success response to the requestor address. 
 
 
 
     
     
       13. The authentication method of  claim 12  wherein:
 the provided credentials include a username and a hash of a password; and 
 the username specifies the identity for the provided credentials. 
 
     
     
       14. The authentication method of  claim 12  wherein:
 the number of identity-not-found failures related to the first address is restricted to those occurring in a period of time prior to the analysis and 
 the threshold and the period of time are configurable by an administrator. 
 
     
     
       15. The authentication method of  claim 12  further comprising:
 specifying, with the processor hardware, an expiration time when adding the first address to the block list; and 
 in response to the expiration time being reached, removing, with the processor hardware, the first address from the block list. 
 
     
     
       16. The authentication method of  claim 15  wherein the expiration time is based on a sum of a time of the triggering event and a configurable block length. 
     
     
       17. The authentication method of  claim 12  further comprising:
 in response to the provided credentials matching the selected credentials, recording, with the processor hardware, a success event in the event cache, 
 wherein the success event includes the identity. 
 
     
     
       18. The authentication method of  claim 17  wherein:
 the failure event indicates the identity; and 
 the method further comprises,
 analyzing, with the processor hardware, events in the event cache to determine a number of unique identities presented by the first address within a time period; and 
 identifying, with the processor hardware, the triggering event in response to the number of unique identities presented within the time period exceeding a second threshold. 
 
 
     
     
       19. The authentication method of  claim 12  further comprising:
 in response to the identity specified by the provided credentials being found in the store of credentials but the provided credentials failing to match any of the store of credentials, transmitting, with the processor hardware, the authentication failure response to the requestor address and recording, with the processor hardware, the failure event in the event cache, wherein the failure event indicates the requestor address and indicates a credential failure mode; 
 analyzing, with the processor hardware, events in the event cache to determine a number of total failures corresponding to the first address; and 
 identifying, with the processor hardware, the triggering event in response to the number of total failures exceeding a second predetermined threshold. 
 
     
     
       20. The authentication method of  claim 12  further comprising reducing, with the processor hardware, the threshold for the first address in response to the first address having been previously blocked. 
     
     
       21. The authentication system of  claim 1  wherein in response to the specified address being present in the block list, the authentication system selectively transmits the authentication success response to the requestor address based on a random number and a reference value. 
     
     
       22. The authentication system of  claim 21  wherein if the random number is less than or equal to the reference value, the authentication system transmits the authentication failure response to the requestor address and if the random number is greater than the reference value, the authentication system transmits the authentication success response. 
     
     
       23. The authentication system of  claim 1  wherein in response to the specified address being present in the block list, the authentication system transmits the authentication success response to the requestor address in response to the credentials being present in a canary cache. 
     
     
       24. The authentication method of  claim 12  wherein in response to the specified address being present in the block list, the authentication method selectively transmits the authentication success response to the requestor address based on a random number and a reference value. 
     
     
       25. The authentication method of  claim 24  wherein if the random number is less than or equal to the reference value, the authentication method transmits the authentication failure response to the requestor address and if the random number is greater than the reference value, the authentication method transmits the authentication success response. 
     
     
       26. The authentication method of  claim 12  wherein in response to the specified address being present in the block list, the authentication method transmits the authentication success response to the requestor address in response to the credentials being present in a canary cache.